getdesktop-ledgr[.]framer[.]wiki

PhishDestroy identifies getdesktop-ledgr.framer.wiki as a potentially malicious domain currently under active investigation for generic_phishing activity. This subdomain of framer.wiki appears to impersonate Ledger hardware wallet services, likely deployed as a drainer kit targeting cryptocurrency users. The fraudulent portal is designed to deceive victims into connecting their Ledger wallets and approve malicious token transfer permissions, enabling unauthorized fund extraction. Threat actors are exploiting Framer’s publishing platform to host the fraudulent site, leveraging legitimate infrastructure to bypass traditional security filters while maintaining a facade of credibility through the inclusion of 'Ledger' branding.

This domain resolves to IP 31.43.160.6 and utilizes a Let's Encrypt SSL certificate, indicating an attempt to appear legitimate at the transport layer. VirusTotal currently reports 10/95 detections, suggesting the site remains undetected by standard antivirus engines as of this analysis. The domain has not been flagged by Google Safe Browsing (GSB) and has no known presence on major blocklists. WHOIS data indicates recent creation with limited historical presence, which is consistent with tactics used by fraudulent actors to reduce traceability. The site’s reliance on Framer’s publishing infrastructure and the absence of broad detection underscore the potential for delayed discovery and amplified victim reach.

As of this report, getdesktop-ledgr.framer.wiki remains active and under investigation with an 'under_investigation' status. PhishDestroy recommends immediate avoidance of any interaction with the domain, including clicking, downloading, or entering credentials. Users who have recently visited the site are advised to disconnect their hardware wallets, revoke any connected app permissions, and scan devices for malware using trusted security software. While current detection rates are low, the domain’s active status and suspicious configuration warrant heightened vigilance. The risk remains elevated as long as the domain remains accessible and undetected by major security platforms.